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ABSTRACT 

We note a fact which is simple, but may be useful for the 
networking research community: essentially any change 
to BGP's decision process can cause divergence — or 
convergence when BGP would otherwise diverge. 

1. INTRODUCTION 

The Internet's interdomain routing protocol, BGP [3], 
uses a decision process to select a single best route to 
each destination when presented with multiple options. 
This decision process can be customized and modified 
at each router to select routes that achieve various ob- 
jectives such as load balance, path quality, or security. 
When proposing such a modification, we were asked a 
very natural question: Given the known problem that 
a distributed network of BGP routers might never con- 
verge to a stable state [5J, might the proposed change 
make the problem worse? That is, do there exist cases 
in which the standard BGP protocol converges, but the 
proposed modification causes divergence? 

The Hippocratic goal to do no harm is natural to 
desire of any modification to BGP's decision process, 
given its global importance. However, we observe here 
that any modification to the decision process can cause 
divergence in some case when standard BGP would con- 
verge, under very mild conditions. Specifically, (1) the 
modified BGP must actually differ, in that there is some 
case where the modified and standard BGP both con- 
verge, but to different outcomes; and (2) the modifica- 
tion either may be deployed at only some routers, or the 
modification preserves the expressiveness of standard 
BGP (for example by maintaining the initial operator- 
configurable LOCAL_PREF step). Even seemingly triv- 
ial changes, like changing a tiebreaking step from "low- 
est router ID" to "highest router ID", satisfy these con- 
ditions and therefore may cause divergence. 

But this fact should not incite fear of modifying BGP. 
Indeed, any modification could also cause convergence 
when BGP would otherwise diverge. Thus, fear of mod- 
ifying BGP can be equally matched with fear of not 
modifying BGP. 

Instead, what the result points out is that the ques- 



tion of whether new cases of divergence could happen 
by switching from decision process A to B is uninforma- 
tive, because the answer is always "yes" for any distinct 
values of A and B. A more valuable question is how con- 
vergence is affected in realistic cases. This, of course, is 
a much more difficult question to answer convincingly, 
not least because it requires assumptions about what is 
realistic. 

2. MODEL 

2.1 The standard model 

We follow the model of [l] Q An instance of the Stable 
Paths Problem (SPP) consists of a graph G = (V, E) 
and a set A of ranking functions, one for each node 
v € V. Node w's ranking function A„ specifies which 
paths v prefers; specifically, if \ v (Pi) > \ V {P2) then v 
prefers P\ over P 2 - We require that \ V (P\) ^ A„(P2) 
unless Pi and P 2 have the same first edge (since BGP 
learns only a single route from each neighbor, we will 
never need to compare two such routes). 

The "null path" e represents the absence of a path to 
the destination, and is considered a valid path. Since 
BGP's decision process may eliminate a path P due to 
import or export filters, we may have X v (e) > A„(P). 
We write P1P2 to denote the concatenation of two paths, 
or vwP to concatenate the edge (i>, w) with path P. 

There is a single distinguished node to which all 
nodes are choosing paths. At any given time t, each 
node v has a current path assignment ir t (v). At all 
times t, we have 7Tt(0) = (i.e., the destination always 
selects the trivial one-hop path to itself). The dynam- 
ics of the protocol are modeled by a sequence of "acti- 
vations" of nodes A = (v^ , i>i 2 , . . .) in which each node 
(other than 0) must appear infinitely often. At time t, 
only node A t updates its selected route n t (A t ) and all 
other nodes are unaffected. Specifically, if v = At, then 
v chooses its new best route by setting 

TTtiv) = &rgm&x P<£choices(vt) \ v {P), (1) 

x We omit [l]'s FIFO queues and permitted path sets, which 
other features of the model can emulate. 



where choices(v,t) is the set of all simple (non-loopy) 
paths of the form vwirt(w) where w is a neighbor of v 
and ir t (w) is w's current path. 

A node v is stable in path assignment n if execut- 
ing ([I]) produces no change. A path assignment 7r is 
stable if all nodes are stable in tt. An instance (G, A) 
is safe if any activation sequence eventually produces 
a stable path assignment, regardless of the initial path 
assignment. 

2.2 Modeling a modified decision process 

A ranking function A encapsulates the final result of 
the BGP decision process, whether that is due to an 
operator's assignment of the LOCAL_PREF attribute 
for a route, or minimizing the AS_PATH length, or any 
of the various other factors that affect the decision pro- 
cess. So a "modified BGP decision process" is simply a 
different ranking function A'. 

But two ranking functions might be effectively equiv- 
alent, in that they produce the same outcome in prac- 
tice. The following definition rules out such degenerate 
modifications. 

Definition 1. Two ranking functions A, A' are safely 
distinct if there exists a network TV for which (AT, A) 
and (N, A') are safe, but their stable states differ. 

(Note that since the two instances are safe, they each 
have a single stable state [2|4].) As mentioned in the in- 
troduction, this definition restricts our attention to the 
case that there is some network on which A and A' are 
safe and converge to different outcomes. While this ap- 
pears to be a very mild restriction, it is conceivable that 
A and A' always produce identical stable states except 
on networks where at least one of them may diverge. In 
that case, reasoning about differences in outcomes in- 
volves the system's dynamics, i.e., particular activation 
sequences. It would be possible to use our technique to 
make statements about particular activation sequences, 
but we choose to avoid that complication here. 

3. PRECARIOUSNESS 
3.1 Partial deployment 

In this section we show that any safely distinct mod- 
ification of the BGP decision process can cause diver- 
gence or convergence, when partially deployed. 

But what exactly is a "partial deployment" of the 
modified decision process? Since a ranking function is 
defined for a specific network, how can we "deploy" it 
in a new environment where it may have to rank new 
paths? Fortunately we can sidestep this modeling com- 
plication since we will need to use the ranking functions 
in only a black-box manner in our theorem. 

Specifically, suppose we have ranking functions X N 
and A G on networks N and G, respectively, and a given 



subgraph N' C G is identical to N. Then a partial 
deployment of A^ in (G, A G ) is an instance (G, A*) 
where 

f A G (P) if ve G\ N' 
X* v (P) = 1 Af(P) if ve N' andPCiV' 
[ -oo if veN' and P % A'. 

In other words, the new ranking function A* mimics 
A G except on N' where it mimics X N . The third case 
causes A* to rank any path outside N' strictly less than 
e, which ensures that X N never is called upon to rank a 
path outside the network N' on which it is well-defined. 
This models a scenario in which nodes outside N' export 
no BGP route advertisements to nodes in N'. 
We can now state and prove the theorem. 

Theorem 1. If X and X' are safely distinct, then there 
exists an SPP instance (G, A G ) in which a partial de- 
ployment of X is safe, but a partial deployment of X' has 
no stable path assignment. 

One can interpret the theorem as follows. If we let 
A be the behavior of standard BGP, then the partial 
deployment of A in (G, A G ) just means that the whole 
network runs standard BGP, and the modification A' 
causes divergence. Symmetrically, we can just as easily 
let A' be the behavior of standard BGP, in which case 
the modification causes convergence. 

PROOF. We construct G as follows (Fig. [I]). Since 
A and A' are safely distinct, there is a network N on 
which their stable states differ. We include in G two 
copies of N which we call N and N' , but with only one 
instance of the destination 0. By the condition of the 
theorem, there must exist a w € N which has differing 
path selections in the stable states of (N, A) and (N, A'). 
Let w' be the corresponding node in N' . We add a new 
node x connected to w and w'. Finally, we add an 
"oscillator gadget" — a triangle a, b, c with each node 
connected to the destination — and connect a to x. 

We construct A G as follows. First, A G = X v for all 
v € N. The behavior of A G on N' is irrelevant, since 
this is where we will place the partial deployment of A 
or A'. 

Second, A G ranks paths as follows. Let P\, . . . , P& be 
a list of all w ~> paths in N, and let P[, . . . , P' k be the 
corresponding w' paths in N' . Without loss of gen- 
erality, suppose that Pi is w's selected path in the stable 
state of (N, A'), while w's selected path in (N, A) is some 
other path p. Then we let X^(xwPi) > X®(xw'P[) > 
A G (a;u;P 2 ) > A G (WP^) > . . . > X^(xwP k ) > X°{xw'P' k ) 
> e, with all other paths ranked below e. 

Third and finally, on the oscillator gadget, Xq be- 
haves like the classic Bad Gadget pi: each of a, b, c will 
accept one of two paths, the direct path (e.g. aO) and 
the path via its counterclockwise neighbor (e.g. abO), 
with the latter preferred. However, to this structure we 
add the fact that a most prefers the path axwPi. 
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Figure 1: An SPP instance which converges if and only 
if N and N' have the same stable state. The ranking 
function of certain nodes is written in blue next to the 
node, listing paths from most to least preferred. Multi- 
ple copies of the destination are drawn for clarity, but 
these are in fact the same node. 



With a partial deployment of A on N' , the effect of 
the construction is as follows. Since (N, A) is safe, it 
must have a single stable state [2 ,H| , so N and N' will 
eventually stabilize with corresponding path selections 
Pi and P[. Therefore, since x always prefers a path in 
N over the corresponding path in N' , it will eventu- 
ally select xwPi permanently, causing a to select the 
path axwPi, causing c to select cO, and b to select bcO. 
Thus, a unique stable state is reached for any activation 
sequence. 

On the other hand, consider a partial deployment of 
A' on N' . Since (N',X') is safe it must have a single 
stable state [2j, which we know must differ from the 
stable state of (N, A). Thus, after TV and N' converge, 
node x is presented with two different paths, xwPi and 
xw'P[. It will prefer the path xw'P[ and remain with 
that selection thereafter. With a's possibility of any 
more-preferred path via x now eliminated, the nodes 
a, 6, c mimic the Bad Gadget, and have no stable state. 
Therefore, with a partial deployment of A', this instance 
has no stable state. □ 

3.2 Full deployment 

If the requirement of partial deployment were removed, 
Theorem [T] would no longer hold. Consider, for exam- 
ple, a modified decision process which simply performs 
shortest path routing. The theorem shows that a partial 
deployment of shortest path routing can cause diver- 
gence; however, a full deployment will always converge. 

But the theorem holds with full deployments if we 
add a constraint on the modification: it must preserve 
the expressive power of BGP. One way to formalize this 
is as follows. The operator of each node v specifies a 
partial ranking function At, which may assign multi- 
ple paths the same value. A decision process is now 
a function d which, given a partial ranking function A^, 



returns a ranking function d^ consistent with A„ (that 
is, X\,(Pi) > X V {P 2 ) implies d^(Pi) > d kv (P 2 )). In- 
tuitively, d breaks any "ties" in A's ranking of paths|^] 
We let d k refer to the set of ranking functions produced 
by applying d to the set of partial ranking functions A„ 
over all nodes v. 

Taking common ISP business relationships as an ex- 
ample, an operator might specify X V (P) = 100 for paths 
through v's providers, A„(P) — 200 for paths through 
peers, and X V (P) = 300 for paths through customers. If 
v has multiple providers, peers, or customers, this will 
not always yield a unique best path; the decision process 
d breaks those ties, perhaps by examining path length 
or other factors. However, the operator can choose to 
specify an arbitrary ranking function by giving A„ (P) a 
distinct value for each P (in which case d does not af- 
fect the outcome). In this sense, any modified decision 
process preserves BGP's expressiveness. 

We can now show a theorem analogous to Theorem [T] 
without the partial deployment requirement. The proof 
is an easy adaptation of our earlier technique: since the 
partial ranking function can be used to force any total 
order, we can build the necessary ranking functions even 
though the modification is deployed at all nodes. 

Definition 2. Two decision processes d, d! are safely 
distinct if there exists a network N and partial ranking 
functions A for which (N, d k ) and (N, d'~) are safe, but 
their stable states differ. 

Theorem 2. Ifd anddl are safely distinct, then there 
exists a network G and partial ranking functions X G in 
which (G,d^ G ) is safe, but (G,d'~ a ) has no stable path 
assignment. 

PROOF. Let N and A be such that (N, d~ x ) and (N, d'^) 
are safe, but their stable states differ. We construct G 
based on N as in the proof of Theorem [I] Let A G be 
the ranking functions constructed in the proof of The- 
orem [I] with A = d^ and A' = <i'- . Define the partial 

ranking functions A as 

!A G if v G {x, a, b, c} 
d x v if we W 
A„" if w € N'. 

Note that applying one of the decision processes to A 
can only vary its behavior for v G N' . With this con- 
struction, applying the decision process d yields ranking 
functions d^ G which are exactly equivalent to A G with 
a partial deployment of on N' . Likewise, d'^ G is ex- 
actly equivalent to A G with a partial deployment of <i'- 
on N'. Therefore, the result follows by the argument of 
the proof of Theorem [l] □ 

2 Recall from the definition of a ranking function that 
might still have ties, but only between two routes that go 
through the same neighbor, which we never need to compare. 
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4. EXTENSIONS 
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Our results dealt with decision processes which differ 
in their final stable state. One can also show that if 
there is any difference in path selections in two rank- 
ing functions A and A' at any moment during the dy- 
namic convergence process, then for a particular acti- 
vation sequence, a partial deployment of A' will diverge 
while a partial deployment of A will converge (or vice 
versa). This involves inserting a gadget (essentially Dis- 
agree [l]) between x and a in the construction of Fig.[l] 
to "remember" that some difference has occurred in the 
past. In one sense, this is stronger than our previous re- 
sults, as it applies even to transient differences between 
A and A'. However, it is less satisfying since it needs 
an activation sequence that runs N and N' in lockstep. 
With any variation in timing, even two copies of A could 
be judged to be different at some moments in time. 

One could consider more general models of the BGP 
decision process, perhaps treating it as a state machine 
with memory, in order to model features such as route 
flap damping [6] which change their preferences across 
time. Since our theorems use A and A' essentially as 
black boxes, such extensions may be straightforward. 
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